Any stablecoin investment made through a DeFi platform exposes the investor to a chain of nested, independent and cumulative risks. This map distinguishes three layers, sets out what the MiCA framework does and does not cover, and offers six good practices for protection.
The three layers are independent: an event on one is not covered by the protections of the others. In a DeFi hack, the investor's protection depends solely on the platform's terms (insurance, reserve fund); MiCA does not guarantee repayment.
02Risks layer by layer
The DeFi protocol: the smart contract is law, but it can be exploited
Smart contract hack: a code vulnerability is exploited, funds are stolen or destroyed, with no automatic legal repayment mechanism.
Protocol bug: a logic error blocks deposits, prevents withdrawals or wipes out part of accrued yield.
Liquidity risk: in a run, the protocol may be unable to meet all withdrawals at once.
No MiCA coverage: “fully decentralised” protocols escape any disclosure or reserve obligation.
The platform: bankruptcy and segregation
Segregated account (MiCA-compliant model)
Non-segregated account (creditor risk)
Ownership
You directly own the stablecoins
The platform holds the tokens in its own name; you only have a claim
In bankruptcy
Priority return, assets separate from the platform's balance sheet
Insolvency proceedings, uncertain repayment, haircut and long delays
Analogy
Securities account with a financial intermediary
Deposit in a failed bank, without deposit insurance
The issuer: what MiCA guarantees, and what remains
What MiCA guarantees
Residual risks in difficulty
1:1 reserve coverage of tokens issued
Insufficient reserves through fraud or mismanagement: a haircut remains possible
Reserves separated from the issuer's own funds
Reserves invested in bonds or deposits that are themselves in difficulty
Redemption at par for any holder
Lengthy bankruptcy proceedings before any repayment
Supervision by the EBA (large issuers) or national authority; regular audits
Depeg through loss of confidence, even without bankruptcy; accounts frozen by authorities (AML, sanctions)
03MiCA's protection perimeter, and six good practices
MiCA protects
MiCA does not protect
Stablecoin issuers: 1:1 reserves, audits, redemption right
“Fully decentralised” DeFi protocols
Platforms (CASPs): mandatory segregation of client assets
Deposit guarantee: no crypto equivalent
Minimum prudential soundness of regulated operators
Smart contract hacks (pure technology risk)
Prior risk disclosure
Platform operational risks (hack, key error)
Coordinated EBA / national supervision; complaint mechanisms
Fraud or mismanagement of reserves; delays or haircuts in bankruptcy
Check asset segregationRead the terms: are stablecoins held in a segregated account or pooled? Are you the direct owner or merely a creditor?
Validate the issuer's MiCA statusCheck that it is an authorised EMT or ART; review the reserves, audit reports and any rating.
Diversify exposuresDo not concentrate on one issuer, platform or protocol: the risk of the three layers adds up.
Size DeFi exposureDistinguish “plain” stablecoins (issuer risk only) from DeFi vaults (cumulative risks) and size the amount to your tolerance.
Check insurance coverSome platforms insure DeFi losses; this is not required by MiCA: check caps and conditions.
Plan exit liquidityMake sure you have direct access to the issuer or a partner exchange to convert into euros outside the intermediary platform.
Sources : OpenbanQ analysis, June 2026. For information only; not investment advice.